If the service provider will have access to the principal’s confidential information (e.g. information on its business and customers) then confidentiality and privacy obligations must be included, particularly if confidentiality is an issue for your business, in order to protect the principal.